Privacy Policy Política de Privacidad y Tratamiento de Datos Personales

🇺🇸 ENGLISH VERSION

1. Who we are and scope of this policy

jsadsAI | José Santamaría is an AI business-architecture and technology consulting firm operated by José David Santamaría Corrales (Tax ID / NIT 8430652-6), domiciled in Medellín, Colombia. We serve business clients (B2B) in Colombia, across Latin America, and globally — including the United States. This policy explains, in plain language, what information we collect through www.jsadsai.com, our email channels and our WhatsApp business line, why we collect it, and the rights available to you.

jsadsAI is a small consulting firm. We do not operate a mass-market consumer product, we do not knowingly collect information from children, and we do not sell personal information to third parties. We describe below, transparently, how this policy relates to U.S. state privacy laws, using California's framework as our structural benchmark.

2. Information we collect

We collect information that visitors, prospects and clients provide voluntarily through contact forms, email, WhatsApp, discovery calls, or interactions with our automation systems and AI agents. Depending on the interaction, this may include:

• Identifiers: name, business email address, phone/WhatsApp number, city/country.
• Professional/employment information: company name, job title, industry.
• Commercial information: services requested, proposals discussed, communications history.
• Technical/process information: operational or technical details shared exclusively for the purpose of diagnosing, auditing, or designing AI-first architectures.
• Internet/website activity: our own first-party, cookieless measurement of how the site is used (no IP address stored, no sensitive profiling) and, only if you accept the corresponding categories in our consent banner, the data Google Analytics 4 (Analytics) and Google Ads (Advertising, Personalisation) collect. See the Cookie Policy for the exact categories, cookies and identifiers.

We do not knowingly collect biometric information, precise geolocation, government identification numbers, or health information through this website.

3. Sources of information

We collect information directly from you (forms, email, WhatsApp, calls/meetings) and, incidentally, from your interaction with our website and automation tools. We do not purchase personal information from data brokers.

4. How we use information (purposes)

• Business development: responding to inquiries, scheduling consultations, running process/AI audits, and preparing technical proposals or contracts.
• Service delivery: providing the architecture, web/app development, and automation services you contract, and related technical support.
• Marketing communications: sending relevant updates about AI systems, digital ecosystems, and new offerings (you may opt out at any time).
• Administration and legal compliance: invoicing, accounting, and compliance with applicable tax or regulatory obligations.
• Analytics: understanding how the website is used, to improve content and user experience — always with our first-party cookieless measurement, and with Google Analytics 4 only if you accept the Analytics category.
• Advertising measurement: knowing whether a visit came from a Google Ads campaign and whether it led to a contact, and building remarketing audiences — only if you accept the Advertising category; personalised advertising only if you accept Personalisation. Accepting Analytics does not accept Advertising.

Your consent for these optional categories is requested in the banner on your first visit and is passed to Google through Google Consent Mode v2. You can change it or withdraw it at any time from the “Privacy preferences” link in the footer of every page, without an account; withdrawal takes effect immediately in your browser for future processing.

5. Do we sell or share personal information?

No. jsadsAI does not sell, rent, or "share" (as that term is defined under the CCPA/CPRA, i.e., for cross-context behavioral advertising) personal information to any third party, and has not done so in the preceding 12 months. We honor the Global Privacy Control (GPC) signal as a valid opt-out preference signal, even though, as noted above, there is currently no sale or sharing of personal information for you to opt out of.

6. Third parties and service providers

To deliver our services we work with technology infrastructure providers under confidentiality and security commitments, including cloud servers, CRM and automation platforms (such as Make/n8n), and AI providers (such as OpenAI and Google). These providers process data solely to support the services we perform for you — never to build their own marketing profiles from your information. Separately, and only with the consent described in section 4, Google (Google Analytics 4, Google Ads, Google Tag Manager) processes website-usage and advertising data under its own privacy policy.

7. Data retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described above, satisfy legal, accounting, or tax obligations, or resolve disputes — after which it is securely deleted or anonymized.

8. Your privacy rights — California standard, extended voluntarily to all

Applicability note (honest disclosure): jsadsAI is a small consultancy that most likely does not meet the CCPA/CPRA's applicability thresholds (annual gross revenue over $25 million USD, or personal information of 100,000+ consumers/households, or 50%+ of revenue from selling personal information). Even so, as a matter of policy, we voluntarily extend the following rights to any visitor or client who requests them — regardless of the state or country you write to us from:

• Right to Know/Access — what personal information we hold about you and how it is used.
• Right to Correct — inaccurate personal information.
• Right to Delete — your personal information, subject to legal/contractual retention needs.
• Right to Opt-Out of Sale/Sharing — not applicable today, as we do not sell or share data, but honored as a standing commitment.
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information beyond what is necessary to provide our services.
• Right to Data Portability — a copy of your information in a portable format.
• Right to Non-Discrimination — we will never penalize you for exercising these rights.
• Right to Appeal — if we deny a request, you may ask us to reconsider by replying to our decision email.

How to exercise your rights

Send a written request to ceo@jsadsai.com. We will use reasonable methods to verify your identity before acting on the request. We will respond within 45 days of receipt; if more time is needed, we will notify you and may extend the response period by an additional 45 days. An authorized agent may submit a request on your behalf with written proof of authorization.

9. Other priority states — informational overview

We recognize the specific frameworks of other states with significant Latino populations. This is a good-faith, non-exhaustive summary — not legal advice, and state privacy law changes frequently:

• Texas — Texas Data Privacy and Security Act (TDPSA): rights similar to access, correction, deletion, and portability; includes a small-business exception aligned with SBA standards, which is likely to apply to jsadsAI.
• Colorado — Colorado Privacy Act (CPA): similar rights, and recognition of universal opt-out signals such as Global Privacy Control.
• New Jersey — New Jersey Data Privacy Act (NJDPA): rights broadly comparable to CPA/VCDPA-style frameworks.
• Florida — Florida Digital Bill of Rights (FDBR): aimed primarily at very large technology platforms; jsadsAI does not meet its thresholds, but we honor the same transparency principles.
• Illinois — we do not collect biometric information. If we ever were to collect biometric data from Illinois residents, we would obtain informed consent as required by the Biometric Information Privacy Act (BIPA).
• New York — no comprehensive consumer privacy law equivalent to the CCPA exists in New York as of this policy's date; we apply data-security practices consistent with New York's SHIELD Act.
• Arizona — no comprehensive consumer privacy law currently in force; we apply the same transparency principles by default.

State privacy legislation evolves frequently. This summary is provided in good faith for informational purposes. Regardless of your state of residence, you may write to ceo@jsadsai.com to exercise any of the rights described in this policy.

10. Federal frameworks we respect

• FTC Act — we do not engage in unfair or deceptive commercial practices or misleading advertising.
• CAN-SPAM Act — our marketing emails identify the sender clearly and include a straightforward opt-out mechanism.
• TCPA — we seek appropriate consent before sending marketing messages or calls via WhatsApp/phone.
• COPPA — this website is not directed to children under 13, and we do not knowingly collect their personal information.

11. International data transfers

Because jsadsAI is based in Colombia and works with global cloud and AI infrastructure providers, your information may be processed in Colombia and by providers with infrastructure in the United States or other countries (for example, OpenAI, Google, and cloud hosting providers). Given the limited-volume, B2B nature of this data flow, we do not rely on mechanisms such as the EU-U.S. Data Privacy Framework; instead, we take reasonable contractual and security measures with each provider to protect your information wherever it is processed.

12. Security

We implement reasonable technical and organizational safeguards appropriate to the nature of the information we handle, and we require our infrastructure and AI providers to maintain equivalent security and confidentiality standards.

13. Changes to this policy

We may update this policy to reflect legal, technical, or business changes. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be posted on this page.

14. Contact

Questions, requests, or complaints regarding this policy: ceo@jsadsai.com.

🇨🇴 VERSIÓN EN ESPAÑOL

1. Identificación del responsable del tratamiento

En estricto cumplimiento de la legislación colombiana aplicable, específicamente la Ley Estatutaria 1581 de 2012 (Ley de Protección de Datos Personales o Habeas Data) y el Decreto Reglamentario 1377 de 2013, y con alcance para nuestras operaciones a nivel Latam y Global, se informa que el responsable del tratamiento de la información es:

• Titular / Nombre Legal: José David Santamaría Corrales (jsadsAI | José Santamaría)
• NIT: 8430652-6
• Dirección física: Calle 20A #77-15, Medellín, Colombia.
• Correo público de contacto: ceo@jsadsai.com
• Teléfono comercial: +57 315 488 3013
• WhatsApp corporativo: +57 (315) 488-3013

2. Datos recopilados y alcance

jsadsAI recopila información corporativa y personal suministrada de manera voluntaria por clientes potenciales, empresas o profesionales a través de formularios en www.jsadsai.com, correos electrónicos oficiales, líneas de atención de WhatsApp o interacciones con nuestros sistemas de automatización y Agentes IA.

Los datos pueden incluir: nombre, correo electrónico corporativo, número de teléfono/WhatsApp, ciudad/país, nombre de la empresa, cargo, e información técnica o de procesos operativos compartida exclusivamente para el diagnóstico, auditoría y diseño de arquitecturas AI-first.

Sobre el uso del sitio web, recogemos nuestra propia medición sin cookies (sin almacenar la dirección IP y sin perfilado sensible) y, sólo si aceptas las categorías correspondientes en nuestro aviso de consentimiento, los datos que recogen Google Analytics 4 (Analítica) y Google Ads (Publicidad, Personalización). Las categorías, cookies e identificadores exactos están en la Política de Cookies.

3. Finalidad del tratamiento de la información

Bajo nuestro enfoque de convertir procesos manuales en sistemas inteligentes, los datos recolectados serán tratados con altos estándares de confidencialidad para las siguientes finalidades:

• Gestión estratégica y comercial: atender solicitudes de contacto, agendar reuniones de consultoría, realizar auditorías de procesos IA y presentar propuestas técnicas o contratos.
• Ejecución operativa: prestar los servicios de arquitectura, desarrollo web/app y automatización contratados, así como proveer soporte técnico continuo.
• Marketing y comunicaciones: enviar información técnica de alto valor, actualizaciones sobre ecosistemas digitales, nuevos activos monetizables y comunicaciones de la marca. (El usuario podrá solicitar la baja de estas comunicaciones en cualquier momento.)
• Administración y legalidad: gestión de facturación, contabilidad y cumplimiento de obligaciones fiscales o normativas vigentes.
• Data Intelligence: analizar métricas de interacción en el sitio web para optimizar procesos y mejorar la experiencia digital de nuestros sistemas — siempre con nuestra medición propia sin cookies, y con Google Analytics 4 sólo si aceptas la categoría Analítica.
• Medición publicitaria: saber si una visita vino de una campaña de Google Ads y si terminó en un contacto, y construir audiencias de remarketing — sólo si aceptas la categoría Publicidad; publicidad personalizada sólo si aceptas Personalización. Aceptar Analítica no implica aceptar Publicidad.

El consentimiento para estas categorías opcionales se solicita en el aviso de tu primera visita y se comunica a Google mediante Google Consent Mode v2. Puedes cambiarlo o retirarlo en cualquier momento desde el enlace «Preferencias de privacidad» del pie de todas las páginas, sin cuenta; la retirada tiene efecto inmediato en tu navegador para el tratamiento futuro.

4. Seguridad, confidencialidad y terceros

Como arquitectos de sistemas digitales, entendemos el valor crítico de la información. Hemos implementado rigurosas medidas de seguridad técnicas y organizativas para proteger sus datos. En ningún caso vendemos, alquilamos ni comercializamos bases de datos a terceros.

Dado que diseñamos sistemas de automatización avanzados y ecosistemas IA, los datos pueden transitar por plataformas de infraestructura tecnológica de primer nivel (ej. servidores Cloud, pasarelas de pago, CRMs, herramientas como Make/n8n o proveedores de IA como OpenAI/Google). Dichos proveedores operan bajo estrictos acuerdos de confidencialidad y estándares de seguridad global. Aparte, y únicamente con el consentimiento descrito en el apartado 3, Google (Google Analytics 4, Google Ads, Google Tag Manager) trata datos de uso del sitio y publicitarios bajo su propia política de privacidad.

5. Derechos de los titulares (Derechos ARCO – Habeas Data)

Como titular de la información, el usuario tiene derecho constitucional a:

• Conocer, actualizar y rectificar sus datos personales en cualquier momento.
• Solicitar prueba de la autorización otorgada para su tratamiento.
• Ser informado sobre el uso que se ha dado a su información personal.
• Revocar la autorización y/o solicitar la supresión del dato cuando no exista un deber legal o contractual que nos obligue a conservarlo.
• Acceder de forma gratuita a los datos que hayan sido objeto de tratamiento.

6. Procedimiento para ejercer sus derechos

Para ejercer sus derechos de consulta, actualización, rectificación o eliminación, el titular debe enviar una solicitud formal por escrito al correo electrónico principal ceo@jsadsai.com indicando en el asunto "Solicitud Tratamiento de Datos - [Su Nombre]". La petición será atendida en un plazo máximo de quince (15) días hábiles, conforme a la ley colombiana.

7. Vigencia y modificaciones

La presente política rige a partir de su publicación oficial. Las bases de datos tendrán una vigencia equivalente al tiempo necesario para cumplir con las finalidades descritas o el plazo exigido legalmente. jsadsAI se reserva el derecho de modificar este documento para adaptarlo a novedades legislativas o tecnológicas, lo cual será actualizado en el sitio web.

Esta política se rige por las leyes de la República de Colombia. Para más información escríbenos a ceo@jsadsai.com.